Claims 

1. (Currently Amended) A method for investigating messages passed in a 
message-passing environment, the method comprising: 

collecting message traces from at least one participant in the message-passing 
environment, wherein each message trace is a series of messages originating from or 
sent to the at least one participant, ordered by time, wherein each message has a first 
piece describing transfer of information and a second piece describing an operation 
being performed in the message; 

converting identifying information pertaining to the at least one participant into an 
indication of a role played by the at least one participant in the message-passing 
environment; 

assembling the messages into at least one message sequence, wherein 
assembling the message sequence comprises i nc l ud e s combining multiple message 
traces into the at least one message sequence, each message trace pertaining to one 
or more messages transmitted by, or received at, a participant, wherein [[the]] 
combining multiple message traces is based on: 
on e or mor e of, 

a specified part i c i pant, participant: 

a specified time fram e , frame: 

a transaction natur e nature: and 

the role played by the at le ast on e specified participant; 
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analyzing the at least one message sequence from the message-passing 
environment to extract information regarding the at least one participant in the 
message-passing environment, wherein the analyzing comprises comparing at least 
one message sequence with a reference message sequence, the reference message 
sequence comprises at least one of a sequence that reflects an error-free operation in 
the message passing environment and a sequence that reflects known failure 
conditions in the message passing environment; 

performing cluster analysis to group the at least one message sequence into at 
least one cluster, wherein the cluster analysis includes forming a data matrix based on 
information in the at least one message sequence and forming the at least one cluster 
based on the data matrix, at least one cluster includes the reference sequence; 

sorting into a ranked order at least two clusters based on a number of members 
associated with each cluster, the sorting prioritized from least members to most 
members associated each of the at least two clusters; and 

outputting [[the]] information into a table format based on the sorting into a 
ranked order, each cluster represented in the table format is linked to information 
regarding an associated message sequence. 

2. (Original) The method according to claim 1, wherein the message- 

passing environment is a network environment including plural participants coupled 
together via a network. 
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3. (Original) The method according to claim 2, wherein the network 
uses an Internet Protocol to transmit messages between participants. 

4. (Original) The method according to claim 2, wherein the messages 
express the information in one of a plurality of message formats. 

5. (Original) The method according to claim 2, wherein the messages 
include information expressed in a markup language. 

6. (Original) The method according to claim 5, wherein the markup 
language is the extensible markup language (XML). 

7. (Original) The method according to claim 2, wherein the network 
uses Simple Object Access Protocol (SOAP) to transmit messages between 
participants. 

8. (Original) The method according to claim 1, wherein the message- 
passing environment is a machine or system including plural interacting components 
that function as message participants. 

9. (Original) The method according to claim 1, wherein the message- 
passing environment is a software program including plural interacting software 
modules that function as message participants. 
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10. and 11. (Canceled) 



12. (Original) 



The method according to claim 1, wherein the assembling 



comprises assembling plural message sequences, and the analyzing comprises 
analyzing the plural message sequences. 

13. and 14. (Canceled) 

15. (Previously Presented) The method according to claim 1, wherein the 
forming of the data matrix involves extracting features from said at least one message 
sequence, including extracting numerical counts for at least one feature present in the 
message sequence, the feature including at least one of: a message command type, a 
sender/receiver pair, a property of the message and an application-level property. 

16. (Previously Presented) The method according to claim 1, wherein the 
forming of the data matrix involves forming a similarity measure which measures the 
difference between said at least one message sequence and another message 
sequence, wherein forming a similarity measure includes : string/sequence matching 
and comparing said at least one message sequence with an optimal functioning 
sequence, a good server trace, a bad server trace, and a known sequence from an 
alternate message-passing environment. 
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17. (Previously Presented) The method according to claim 1, wherein the 
analyzing involves identifying results of the cluster analysis that may warrant further 
investigation, wherein the identifying includes comparing the at least one message 
sequence against a formal model of the message passing environment and placing the 
at least one message sequence into one or more clusters representing adherence to 
the formal model, non-adherence to the formal model and "interesting", wherein 
"interesting" includes indicia of beneficial phenomena, anomalous conditions, and other 
features which cause the at least one message sequence to be singled out from other 
message sequences. 

18. (Canceled) 

19. (Original) A computer readable medium including machine readable 
instructions for implementing the collecting, assembling, analyzing, and outputting 
recited in claim 1 . 

20. (Currently Amended) An apparatus for investigating messages passed 
in a message-passing environment, the apparatus comprising: 

message aggregation logic configured to collect a plurality of messages from at 
least one participant in the message-passing environment, and to assemble the 
messages into at least one message sequence, wherein each message has a first piece 
describing transfer information and a second piece describing an operation being 
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performed in the message , wherein assembling the messages into at least one 
message sequence is based on: 



analysis logic configured to analyze said at least one message sequence from 
the message passing environment to extract information regarding at least the one 
participant in the message-passing environment, wherein the analysis logic is further 
configured to compare said at least one message sequence with a reference message 
sequence, the reference message sequence comprising a sequence that reflects an 
error-free operation in the message passing environment; 

cluster analysis logic configured to perform cluster analysis to group the at least 
one message sequence and the reference message sequence into at least one cluster, 
wherein the cluster analysis logic is configured to form a data matrix based on 
information in the at least one message sequence and form the at least one cluster 
based on the data matrix, the cluster analysis logic is configured to measure a distance 
between two or more message sequences of each cluster formed by the cluster 
analysis logic; and 

output logic configured to output [[the]] information as a two-dimensional 
presentation of the at least one cluster and indicating the reference sequence and the 
distance associated with the at least one message sequence. 



a specified participant; 



a specified time frame; 



a transaction nature; and 



a role played by the specified participant; 
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21. (Original) The apparatus according to claim 20, wherein the 
message-passing environment is a network environment including plural participants 
coupled together via a network. 

22. (Original) The apparatus according to claim 21, wherein the network 
uses an Internet Protocol to transmit messages between participants. 

23. (Original) The apparatus according to claim 21, wherein the 
messages express the information in one of a plurality of message formats. 

24. (Original) The apparatus according to claim 21, wherein the 
messages include information expressed in a markup language. 

25. (Previously Presented) The method according to claim 24, wherein the 
markup language is the extensible markup language (XML). 

26. (Original) The apparatus according to claim 21, wherein the network 
uses Simple Object Access Protocol (SOAP) to transmit messages between 
participants. 

27. (Original) The apparatus according to claim 20, wherein the 
message-passing environment is a machine or system including plural interacting 
components that function as message participants. 
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28. (Original) The apparatus according to claim 20, wherein the 
message-passing environment is a software program including plural interacting 
software modules that function as message participants. 

29. (Original) The apparatus according to claim 20, wherein the message 
aggregation logic is further configured to convert identifying information pertaining to 
said at least one participant into an indication of a role played by the participant in the 
message-passing environment. 

30. (Original) The apparatus according to claim 20, wherein the message 
aggregation logic is further configured to combine multiple message traces into said at 
least one message sequence, each message trace pertaining to one or more messages 
transmitted by and/or received at a participant. 

31. (Original) The apparatus according to claim 20, wherein the message 
aggregation logic is further configured to assemble plural message sequences, and the 
analysis logic is further configured to analyze the plural message sequences. 

32. and 33. (Canceled) 
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34. (Previously Presented) The apparatus according to claim 20, wherein the 
analysis logic is configured to form the data matrix by extracting features from said at 
least one message sequence. 

35. (Previously Presented) The apparatus according to claim 20, wherein the 
analysis logic is configured to form the data matrix by forming a similarity measure 
which measures the difference between said at least one message sequence and 
another message sequence. 

36. (Previously Presented) The apparatus according to claim 20, wherein the 
analysis logic is further configured to identify results of the cluster analysis that may 
warrant further investigation. 

37. (Canceled) 

38. (Original) A computer readable medium including machine readable 
instructions for implementing the message aggregation logic, the analysis logic, and the 
output logic of claim 20. 

39. (Currently Amended) An apparatus for investigating messages passed 
in a message-passing environment, the apparatus comprising: 

means for collecting message traces from at least one participant in the 
message-passing environment, wherein each message trace is a series of messages 
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originating from or sent to the at least one participant, ordered by time, wherein each 
message has a first piece describing transfer of information and a second piece 
describing an operation being performed in the message; 

means for converting identifying information pertaining to the at least one 
participant into an indication of a role played by the at least one participant in the 
message-passing environment; 

means for assembling the messages into at least one message sequence, 
wherein assembling the message sequence comprises i nc l ud e s combining multiple 
message traces into the at least one message sequence, each message trace 
pertaining to one or more messages transmitted by, or received at, a participant, 
wherein [[the]] combining multiple message traces is based on: 
on e or mor e of, 

a specified part i c i pant, participant; 

a specified time fram e , frame; 

a transaction natur e nature; and 

the role played by the at le ast on e specified participant; 
means for analyzing the at least one message sequence from the message- 
passing environment to extract information regarding the at least one participant in the 
message-passing environment, wherein the analyzing comprises comparing at least 
one message sequence with a reference message sequence, the reference message 
sequence comprises at least one of a sequence that reflects an error-free operation in 
the message passing environment and a sequence that reflects known failure 
conditions in the message passing environment; 
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means for performing cluster analysis to group the at least one message 
sequence and the reference message sequence into at least one cluster, wherein the 
cluster analysis includes forming a data matrix based on information in the at least one 
message sequence and forming the at least one cluster based on the data matrix; 

means for storing the at least one message in a master collection of message 
sequences; 

means for culling the master collection of message sequences for at least one 
subset of a message sequence based on specified criteria including one or more of: a 
specified time range, transaction type, participants involved in at least one message 
exchange, objectives of an analyst and a nature of the message-passing environment 
involved; and 

means for storing the at least one subset for subsequent analysis; and 
means for outputting [[the]] information. 

40. (Canceled) 

41. (Previously Presented) The apparatus according to claim 20, wherein the 
reference message sequence is a sequence that reflects known failure conditions within 
the message passing environment. 
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